DllCanUnloadNow
DllGetClassObject
Kmkncjl
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
Behavioral task
behavioral1
Sample
85a882d4f41c34d7328d720d92215f2c_JaffaCakes118.dll
Resource
win7-20240708-en
Target
85a882d4f41c34d7328d720d92215f2c_JaffaCakes118
Size
70KB
MD5
85a882d4f41c34d7328d720d92215f2c
SHA1
3c2db9654cb2b2a47d4072efee24a3a50c54ccd2
SHA256
b6ceffa44cec855125763557952e71486c3401da0a6223734a606d30067a9947
SHA512
ca57f54394d39530c6327e0facc6fb2c98baed365be1b9312a3605905cb835933c91f8d9fe1ae53546c81ebc05374fa1a8966b021e7984a16d7dde4db19f3c29
SSDEEP
1536:rXLwtq0c49MKioFjSz1UFLE/dW5MMbKl89h9LMTlp/8zWqlLqw7t1FVSr77Gnoug:rXLwt/FiaU1Uq/dWFbNr8azD7VS372o3
Detects file using ACProtect software.
resource | yara_rule |
---|---|
sample | acprotect |
resource | yara_rule |
---|---|
sample | upx |
Checks for missing Authenticode signature.
resource |
---|
85a882d4f41c34d7328d720d92215f2c_JaffaCakes118 |
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_DLL
IMAGE_FILE_BYTES_REVERSED_HI
DllCanUnloadNow
DllGetClassObject
Kmkncjl
DllMain
DllRegisterServer
DllUnregisterServer
ServiceMain
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE